Potential HIPAA Violation Costs Lab $16,500

Potential HIPAA Violation Costs Lab $16,500

Waiting too long to provide a medical record request may land you in hot water with the OCR.

Jan. 3 the full-service diagnostic laboratory, Life Hope Labs, LLC, settled on a potential HIPAA violation. The Office of Civil Rights (OCR) at the U.S. Department of Health and Human Services (HHS) alleged the diagnostic laboratory in Sandy Springs, Georgia, was noncompliant because it did not allow access to medical records in a timely manner.

What Does OCR Consider Timely Access?

According to the OCR guidance on “Individuals’ Right Under HIPAA to Access their Health Information 45 CFR § 164.524,”

The Privacy Rule generally requires HIPAA covered entities (health plans and most health care providers) to provide individuals, upon request, with access to the protected health information (PHI) about them in one or more ‘designated record sets’ maintained by or for the covered entity. This includes the right to inspect or obtain a copy, or both, of the PHI, as well as to direct the covered entity to transmit a copy to a designated person or entity of the individual’s choice. Individuals have a right to access this PHI for as long as the information is maintained by a covered entity, or by a business associate on behalf of a covered entity, regardless of the date the information was created; whether the information is maintained in paper or electronic systems onsite, remotely, or is archived; or where the PHI originated (e.g., whether the covered entity, another provider, the patient, etc.).

Timeliness in providing PHI access means that “a covered entity must provide access to the PHI requested, in whole, or in part, … no later than 30 calendar days from receiving the individual’s request. See 45 CFR 164.524(b)(2). The 30 calendar days is an outer limit and covered entities are encouraged to respond as soon as possible,” OCR continues.

Failing to Comply with Timely Access Proves Costly

The complaint filed with the OCR on August 2021 alleged a personal representative asked Life Hope Labs for a copy of her deceased father’s medical records on July 7, 2021. She didn’t receive them until seven months later, on Feb. 12, 2022. “OCR’s investigation determined that Life Hope Labs’ failure to provide timely access to the requested medical records was a potential violation of the HIPAA right of access provision,” according to an HHS press release.

For the settlement, Life Hope Labs agreed to pay $16,500 to resolve the OCR investigation and to implement a corrective action plan with two years of OCR monitoring. You can find a copy of the Life Hopes Resolution Agreement and Correction Action Plan on the HHS website. This is the 43rd case to be investigated and resolved under OCR’s HIPAA Right of Access Initiative.


Lab Pays $16,500 Settlement to HHS, Resolving Potential HIPAA Violation over Medical Records Request | HHS.gov

Individuals’ Right under HIPAA to Access their Health Information | HHS.gov

Life Hopes Resolution Agreement and Correction Action Plan | HHS.gov

Michelle Dick
Follow me

About Has 254 Posts

Michelle A. Dick, BS, provides writing and editorial expertise to clients. She is a freelance proofreader for Partners & Napier’s Vine Creative Studios and the owner of My Garden Gal, a garden maintenance and landscaping business. Prior to becoming a free agent, Dick was an executive editor for AAPC.

Leave a Reply

Your email address will not be published. Required fields are marked *